ace-assign 0.64.0 → 0.66.1

data/lib/ace/assign/authority/service_evidence.rb

@@ -1,6 +1,11 @@
 # frozen_string_literal: true
 
+require_relative "../molecules/evidence_journal"
 require_relative "../molecules/canonical_evidence"
+require_relative "service_cleanup_evidence"
+require_relative "service_cleanup_dispatch"
+require_relative "service_publication_evidence"
+require_relative "../molecules/execution_scope_lineage"
 
 module Ace
   module Assign
@@ -9,30 +14,61 @@ module Ace
       # The journal supplies the record and transient pending view; callers
       # never supply an alternate reader, artifact path or trusted flag.
       class ServiceEvidence
+        include ServiceCleanupEvidence
+        include ServiceCleanupDispatch
+        include ServicePublicationEvidence
         FIELDS = (Molecules::EvidenceJournal::TERMINAL_BINDING_FIELDS +
           %w[dispatch_ticket_id claim_binding candidate_generation claim_generation policy_digest]).freeze
+        CHALLENGE_FIELDS = %w[version request_id input_digest claim_binding dispatch_ticket_id no_effect_challenge
+          challenge_generation failure_event_digest failure_generation].freeze
+        INSPECTION_FIELDS = %w[version request_id input_digest claim_binding no_effect_challenge challenge_generation
+          challenge_event_digest failure_event_digest failure_generation target dispatch_phase effect_absent
+          handler_terminated writers_absent].freeze
 
-        def initialize(journal:)
+        def initialize(journal:, cleanup_artifacts: nil)
           @journal = journal
           @canonical = Molecules::CanonicalEvidence.new(journal: journal)
+          @cleanup_artifacts = cleanup_artifacts
         end
 
-        def context(record, no_effect: false)
+        # Executor-only projection from the same authenticated original record;
+        # selectors never come from the receiver or a caller-supplied target.
+        def settlement_context(record, commit: @journal.ref_value, read_view: nil)
+          pending = {commit: commit, service_read_view: read_view}
+          context(record, pending: pending)
+          challenge = challenge!(record, pending: pending, current: false) if
+            %w[no_effect_challenge challenge_generation challenge_event_digest].any? { |key| record.key?(key) }
+          proof = cleanup_dispatch_context!(record, commit: commit, pending: pending) if
+            record.values_at("operation", "dispatch_phase") == ["prune-preserved-workspace", "dispatch_started"]
+          settlement_projection(record, pending, challenge, proof)
+        rescue KeyError, TypeError
+          raise AttemptErrors::EvidenceUnavailable, "original service settlement context is incomplete"
+        end
+
+        def context(record, no_effect: false, pending: nil)
           binding = FIELDS.to_h { |key| [key, record.fetch(key)] }
+          if record.fetch("operation") == "prune-preserved-workspace" && record["dispatch_phase"] == "dispatch_started"
+            binding["operation_owner_binding"] = record.fetch("operation_owner_binding")
+            executor = record.fetch("executor_process_binding")
+            boot = record.fetch("worker_process_binding").fetch("started_at").split(":").fetch(1)
+            Molecules::ExecutionScopeLineage.validate_process_identity!(executor, boot_id: boot)
+            raise AttemptErrors::EvidenceUnavailable, "original cleanup executor differs" unless executor.fetch("uid") == record.fetch("executor_uid")
+            binding["executor_process_binding"] = executor
+          end
+          if record["operation"] == "publish" && record["dispatch_phase"] != "issued"
+            executor = record.fetch("executor_process_binding")
+            boot = record.fetch("worker_process_binding").fetch("started_at").split(":").fetch(1)
+            Molecules::ExecutionScopeLineage.validate_process_identity!(executor, boot_id: boot)
+            raise AttemptErrors::EvidenceUnavailable, "original publication executor differs" unless executor.fetch("uid") == record.fetch("executor_uid")
+            binding["executor_process_binding"] = executor
+          end
           unless %w[claim_binding policy_digest].all? { |key| binding[key].is_a?(String) && binding[key].match?(/\A[0-9a-f]{64}\z/) } &&
               %w[candidate_generation claim_generation].all? { |key| binding[key].is_a?(Integer) && binding[key].positive? } &&
               binding["dispatch_ticket_id"].is_a?(String) && binding["dispatch_ticket_id"].match?(Molecules::JournalMutation::ID)
             raise AttemptErrors::EvidenceUnavailable, "canonical dispatch binding is invalid"
           end
           if no_effect
-            binding.merge!(%w[no_effect_challenge challenge_generation challenge_event_digest].to_h do |key|
-              [key, record.fetch(key)]
-            end)
-            unless binding["no_effect_challenge"].is_a?(String) && !binding["no_effect_challenge"].empty? &&
-                binding["challenge_generation"].is_a?(Integer) && binding["challenge_generation"].positive? &&
-                binding["challenge_event_digest"].is_a?(String) && binding["challenge_event_digest"].match?(/\A[0-9a-f]{64}\z/)
-              raise AttemptErrors::EvidenceUnavailable, "canonical no-effect challenge is invalid"
-            end
+            return context_for_challenge(record, challenge!(record, pending: pending))
           end
           {kind: "service", project_id: record.fetch("project_id"), assignment_id: record.fetch("assignment_id"),
             attempt_id: record.fetch("attempt_id"), peer_uid: record.fetch("executor_uid"), binding: binding,
@@ -41,13 +77,208 @@ module Ace
           raise AttemptErrors::EvidenceUnavailable, "canonical service evidence binding is incomplete"
         end
 
+        # Exact original challenge and failure selected from the same immutable
+        # canonical prefix as its import. Pending events are the journal owner's
+        # held CAS plan, never caller-supplied alternative history.
+        def challenge!(record, pending: nil, current: true)
+          context(record)
+          selector = record.slice("no_effect_challenge", "challenge_generation", "challenge_event_digest")
+          unless selector.keys.sort == %w[no_effect_challenge challenge_generation challenge_event_digest].sort &&
+              selector["no_effect_challenge"].is_a?(String) && selector["no_effect_challenge"].match?(/\A[0-9a-f]{32}\z/) &&
+              selector["challenge_generation"].is_a?(Integer) && selector["challenge_generation"].positive? &&
+              selector["challenge_event_digest"].is_a?(String) && selector["challenge_event_digest"].match?(/\A[0-9a-f]{64}\z/)
+            raise AttemptErrors::EvidenceUnavailable, "canonical challenge selector is invalid"
+          end
+          commit = pending && pending[:commit] || @journal.ref_value
+          events = if pending && pending[:pending_events]
+            pending.fetch(:current_events) + pending.fetch(:pending_events)
+          else
+            service_read_events(record, pending)
+          end
+          unless Models::EvidenceEvent.chain_valid?(events)
+            raise AttemptErrors::EvidenceUnavailable, "canonical challenge chain is corrupt"
+          end
+          selected = events.select { |event| event["digest"] == record.fetch("challenge_event_digest") }
+          unless selected.size == 1 && selected.first["type"] == "service_no_effect_challenge"
+            raise AttemptErrors::EvidenceUnavailable, "canonical challenge event is missing"
+          end
+          challenge = selected.first
+          payload = challenge.fetch("payload")
+          before = events.take_while { |event| event["digest"] != challenge.fetch("digest") }
+          failures = events.select do |event|
+            %w[service_claim service_transition].include?(event["type"]) &&
+              event.dig("payload", "request_id") == record.fetch("request_id") &&
+              %w[uncertain failed].include?(event.dig("payload", "state"))
+          end
+          failure = before.reverse.find { |event| failures.include?(event) }
+          failure_prefix = before.take_while { |event| event["digest"] != failure&.fetch("digest") }
+          generation = failure_prefix.count { |event| event["type"] == "authority_mutation" } + 1
+          unless payload.is_a?(Hash) && payload.keys.sort == CHALLENGE_FIELDS.sort &&
+              payload["version"].is_a?(Integer) && payload["version"] == 1 &&
+              %w[challenge_generation failure_generation].all? { |key| payload[key].is_a?(Integer) && payload[key].positive? } &&
+              payload["no_effect_challenge"].is_a?(String) && payload["no_effect_challenge"].match?(/\A[0-9a-f]{32}\z/) &&
+              %w[request_id input_digest claim_binding dispatch_ticket_id no_effect_challenge challenge_generation].all? { |key| payload[key] == record[key] } &&
+              failure && (!current || failures.last == failure) && before.any? { |event| event["digest"] == failure.fetch("digest") } &&
+              payload["failure_event_digest"] == failure.fetch("digest") && payload["failure_generation"] == generation &&
+              payload["challenge_generation"] == before.count { |event| event["type"] == "authority_mutation" } + 1
+            raise AttemptErrors::EvidenceUnavailable, "canonical challenge or current failure binding differs"
+          end
+          position = events.index(challenge)
+          if pending && pending[:pending_events]&.any? { |event| event["digest"] == challenge.fetch("digest") }
+            unless pending[:operation] == "claim_service_settlement"
+              raise AttemptErrors::EvidenceUnavailable, "pending challenge has no fixed authority owner"
+            end
+          else
+            update, accepted = events.values_at(position + 1, position + 2)
+            expected_params = record.slice("mapping_id", "assignment_id", "attempt_id", "request_id", "candidate_generation").merge(
+              "head" => record.fetch("candidate_head"), "expected_generation" => payload.fetch("challenge_generation") - 1)
+            unless update && update["type"] == "service_challenge" && update.dig("payload", "request_id") == record.fetch("request_id") &&
+                accepted && accepted["type"] == "authority_mutation" && accepted.dig("payload", "operation") == "claim_service_settlement" &&
+                accepted.dig("payload", "assignment_id") == record.fetch("assignment_id") && accepted.dig("payload", "attempt_id") == record.fetch("attempt_id") &&
+                accepted.dig("payload", "parameters_digest") == Atoms::EvidenceDigest.digest(expected_params) &&
+                accepted.dig("payload", "data", "generation").is_a?(Integer) &&
+                accepted.dig("payload", "data", "generation") == payload.fetch("challenge_generation") &&
+                accepted.dig("payload", "data", "reconciliation_challenge", "challenge_generation").is_a?(Integer) &&
+                accepted.dig("payload", "data", "request_id") == record.fetch("request_id") &&
+                accepted.dig("payload", "data", "reconciliation_challenge") == record.slice("no_effect_challenge", "challenge_generation", "challenge_event_digest")
+              raise AttemptErrors::EvidenceUnavailable, "canonical challenge lacks its accepted authority mutation"
+            end
+            commits = service_read_introductions(record,
+              [challenge.fetch("digest"), failure.fetch("digest"), update.fetch("digest"), accepted.fetch("digest")], pending)
+            unless commits.fetch(challenge.fetch("digest")) == commits.fetch(update.fetch("digest")) &&
+                commits.fetch(challenge.fetch("digest")) == commits.fetch(accepted.fetch("digest"))
+              raise AttemptErrors::EvidenceUnavailable, "challenge record and authority acceptance were not atomic"
+            end
+            original = @journal.service_request(record.fetch("request_id"), commit: commits.fetch(challenge.fetch("digest")))
+            unless original && %w[uncertain failed].include?(original["state"]) &&
+                update.dig("payload", "record_digest") == Atoms::EvidenceDigest.digest(original) &&
+                (FIELDS + %w[mapping_id service_id caller_uid authorization worker_process_binding launch_ticket reservation_generation dispatch_phase]).all? { |key| original[key] == record[key] } &&
+                original.slice("no_effect_challenge", "challenge_generation", "challenge_event_digest") ==
+                  record.slice("no_effect_challenge", "challenge_generation", "challenge_event_digest")
+              raise AttemptErrors::EvidenceUnavailable, "challenge accepted record differs from original binding"
+            end
+          end
+          challenge
+        rescue KeyError, TypeError, NoMethodError
+          raise AttemptErrors::EvidenceUnavailable, "canonical challenge binding is incomplete"
+        end
+
+        def inspection!(content, record, challenge)
+          unless content.is_a?(String) && content.bytesize <= Molecules::CanonicalEvidence::MAX_ARTIFACT_BYTES
+            raise AttemptErrors::EvidenceUnavailable, "no-effect inspection exceeds artifact bounds"
+          end
+          text = content.dup.force_encoding(Encoding::UTF_8)
+          raise AttemptErrors::EvidenceUnavailable, "no-effect inspection is invalid UTF8" unless text.valid_encoding?
+          lines = text.lines.filter_map { |line| line.delete_prefix("ace-service-no-effect ").chomp if line.start_with?("ace-service-no-effect ") }
+          raise AttemptErrors::EvidenceUnavailable, "no-effect inspection is missing or repeated" unless lines.size == 1
+          inspection = JSON.parse(lines.first, create_additions: false, max_nesting: 8,
+            allow_duplicate_key: false, allow_comments: false)
+          inspection_projection!(inspection, record, challenge)
+        rescue JSON::ParserError, KeyError, TypeError
+          raise AttemptErrors::EvidenceUnavailable, "no-effect inspection is malformed"
+        end
+
+        def inspection_projection!(inspection, record, challenge)
+          expected = challenge.fetch("payload").slice("request_id", "input_digest", "claim_binding", "no_effect_challenge",
+            "challenge_generation", "failure_event_digest", "failure_generation").merge("version" => 1,
+              "challenge_event_digest" => challenge.fetch("digest"), "target" => record.fetch("target"),
+              "dispatch_phase" => record.fetch("dispatch_phase"), "effect_absent" => true,
+              "handler_terminated" => true, "writers_absent" => true)
+          unless inspection.is_a?(Hash) && inspection.keys.sort == INSPECTION_FIELDS.sort &&
+              %w[version challenge_generation failure_generation].all? { |key| inspection[key].is_a?(Integer) } &&
+              inspection == expected
+            raise AttemptErrors::EvidenceUnavailable, "no-effect inspection differs from original challenge"
+          end
+          true
+        rescue KeyError, TypeError
+          raise AttemptErrors::EvidenceUnavailable, "no-effect inspection is malformed"
+        end
+
         def call(reference, record, state, pending)
-          expected = context(record, no_effect: state == "failed-settled")
-          if pending && pending[:pending_events]
+          if reference.is_a?(Array)
+            return publication_collection!(reference, record, state, pending) if record["operation"] == "publish"
+            return cleanup_collection!(reference, record, state, pending)
+          end
+          no_effect = state == "failed-settled"
+          expected = context(record, no_effect: no_effect, pending: pending)
+          bytes = if pending && pending[:pending_events]
             @canonical.read_pending(reference, **expected, **pending.slice(:current_events, :pending_events, :blobs, :commit))
           else
             @canonical.read(reference, **expected, commit: pending && pending[:commit] || @journal.ref_value)
           end
+          if no_effect
+            challenge = challenge!(record, pending: pending)
+            inspection!(bytes, record, challenge)
+          end
+          bytes
+        end
+
+        private
+
+        def settlement_projection(record, pending, challenge, proof)
+          selected = nil
+          if challenge
+            latest_failure = service_read_events(record, pending).reverse.find do |event|
+              event["attempt_id"] == record.fetch("attempt_id") &&
+                %w[service_claim service_transition].include?(event["type"]) &&
+                event.dig("payload", "request_id") == record.fetch("request_id") &&
+                %w[uncertain failed].include?(event.dig("payload", "state"))
+            end
+            if latest_failure && latest_failure.fetch("digest") == challenge.dig("payload", "failure_event_digest")
+              selected = challenge.fetch("payload").slice("request_id", "input_digest", "claim_binding",
+                "no_effect_challenge", "challenge_generation", "failure_event_digest", "failure_generation")
+                .merge("challenge_event_digest" => challenge.fetch("digest"))
+            end
+          end
+          execution = record.slice("mapping_id", "candidate_generation", "claim_binding", "dispatch_phase")
+            .merge("head" => record.fetch("candidate_head"))
+          if record["operation"] == "prune-preserved-workspace" && record["dispatch_phase"] == "dispatch_started"
+            execution.merge!(record.slice("operation_owner_binding", "executor_process_binding"))
+            execution.merge!(proof.slice("request_event_digest", "dispatch_event_digest"))
+          end
+          value = {"version" => 1, "request" => record.slice(*Molecules::EvidenceJournal::TERMINAL_BINDING_FIELDS),
+            "execution" => execution, "challenge" => selected}
+          freeze_projection(JSON.parse(JSON.generate(value)))
+        end
+
+        def context_for_challenge(record, selection)
+          expected = context(record)
+          binding = expected.fetch(:binding)
+          binding.merge!(record.slice("no_effect_challenge", "challenge_generation", "challenge_event_digest"))
+          binding.merge!(selection.fetch("payload").slice("failure_event_digest", "failure_generation"))
+          binding["dispatch_phase"] = record.fetch("dispatch_phase")
+          expected
+        end
+
+        def service_read_view(pending)
+          view = pending && pending[:service_read_view]
+          return nil unless view
+          unless view.is_a?(Molecules::EvidenceJournal::ServiceReadView) && view.journal.equal?(@journal) &&
+              view.commit == pending.fetch(:commit) && view.inventory.fetch("commit") == view.commit
+            raise AttemptErrors::EvidenceUnavailable, "service read view differs from its selected owner"
+          end
+          view
+        end
+
+        def service_read_events(record, pending)
+          view = service_read_view(pending)
+          selected = view ? view.inventory.fetch("events").fetch(record.fetch("assignment_id")) :
+            @journal.read_events(record.fetch("assignment_id"), commit: pending && pending[:commit] || @journal.ref_value)
+          selected.select { |event| event.fetch("attempt_id") == record.fetch("attempt_id") }
+        end
+
+        def service_read_introductions(record, selectors, pending)
+          view = service_read_view(pending)
+          return @journal.event_commits!(assignment_id: record.fetch("assignment_id"), event_digests: selectors,
+            commit: pending && pending[:commit] || @journal.ref_value) unless view
+          facts = view.inventory.fetch("introductions").fetch(record.fetch("assignment_id"))
+          selectors.to_h { |selector| [selector, facts.fetch(selector)] }.freeze
+        end
+
+        def freeze_projection(value)
+          value.each_value { |child| freeze_projection(child) } if value.is_a?(Hash)
+          value.each { |child| freeze_projection(child) } if value.is_a?(Array)
+          value.freeze
         end
       end
     end

data/lib/ace/assign/authority/service_publication_evidence.rb

@@ -0,0 +1,110 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      # Publication-specific facts remain artifacts of the existing service
+      # record and canonical import owner, not a second publication journal.
+      module ServicePublicationEvidence
+        PUBLICATION_NEED_FIELDS = %w[schema classification request_id input_digest claim_binding
+          candidate_generation head registry gem_name version artifact_digest dispatch_event_digest previous_challenge_digest].freeze
+        PUBLICATION_FIELDS = %w[publication_challenge_digest publication_challenge_ref publication_challenge_event_digest
+          publication_challenge_generation publication_issuing_event_digest].freeze
+
+        def publication_result!(bytes, record, state:)
+          value = JSON.parse(bytes, allow_duplicate_key: false, allow_nan: false, max_nesting: 16)
+          fields = %w[schema publication target classification code request_id input_digest claim_binding]
+          publication = value.fetch("publication")
+          allowed = state == "succeeded" ? ["registry_exact_artifact"] :
+            %w[provider_rejected_non_otp executor_credentials_unavailable registry_artifact_conflict]
+          unless bytes.bytesize.between?(1, 65536) && value.is_a?(Hash) && value.keys.sort == fields.sort &&
+              value["schema"] == "ace.publication-result/v1" && value["classification"] == state && allowed.include?(value["code"]) &&
+              %w[request_id input_digest claim_binding target].all? { |key| value[key] == record[key] } &&
+              publication.is_a?(Hash) && publication.keys.sort == %w[gem_name version head registry artifact_relative_path].sort &&
+              publication["head"] == record.fetch("candidate_head") && publication["registry"] == "https://rubygems.org" &&
+              publication["gem_name"].is_a?(String) && publication["gem_name"].match?(/\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/) &&
+              publication["version"].is_a?(String) && publication["version"].bytesize.between?(1, 128) &&
+              publication["version"].match?(/\A[0-9]+(?:\.[0-9A-Za-z]+)*(?:-[0-9A-Za-z]+(?:\.[0-9A-Za-z]+)*)?\z/) &&
+              "rubygems:#{publication['gem_name']}:#{publication['version']}" == record.dig("target", "resource") &&
+              publication["artifact_relative_path"].is_a?(String) && publication["artifact_relative_path"].bytesize.between?(1, 4096) &&
+              publication["artifact_relative_path"].end_with?(".gem") &&
+              publication["artifact_relative_path"].split("/", -1).all? { |part| part.match?(/\A[a-zA-Z0-9_.-]+\z/) && !%w[. ..].include?(part) }
+            raise AttemptErrors::ReceiptRejected, "publication result differs from original artifact"
+          end
+          value
+        rescue JSON::ParserError, KeyError, TypeError, NoMethodError
+          raise AttemptErrors::ReceiptRejected, "publication result is invalid"
+        end
+
+        def publication_collection!(references, record, state, pending)
+          unless %w[succeeded failed].include?(state) && references.size == 1
+            raise AttemptErrors::ReceiptRejected, "publication requires one exact result artifact"
+          end
+          expected = context(record, pending: pending)
+          bytes = if pending && pending[:pending_events]
+            @canonical.read_pending(references.first, **expected, **pending.slice(:current_events, :pending_events, :blobs, :commit))
+          else
+            @canonical.read(references.first, **expected, commit: pending && pending[:commit] || @journal.ref_value)
+          end
+          publication_result!(bytes, record, state: state)
+          [bytes].freeze
+        end
+
+        def publication_need!(bytes, record, previous:)
+          value = JSON.parse(bytes, allow_duplicate_key: false, allow_comments: false,
+            allow_nan: false, create_additions: false, max_nesting: 16)
+          unless bytes.bytesize.between?(1, 65536) && value.is_a?(Hash) &&
+              value.keys.sort == PUBLICATION_NEED_FIELDS.sort && value["schema"] == "ace.publication-otp-need/v1" &&
+              %w[otp-required otp-rejected otp-expired].include?(value["classification"]) &&
+              %w[request_id input_digest claim_binding candidate_generation].all? { |key| value[key] == record[key] } &&
+              value["head"] == record["candidate_head"] && value["registry"] == "https://rubygems.org" &&
+              value["previous_challenge_digest"] == previous && value["artifact_digest"] == record.dig("target", "artifact_digest") &&
+              "rubygems:#{value['gem_name']}:#{value['version']}" == record.dig("target", "resource") &&
+              value["dispatch_event_digest"].is_a?(String) && value["dispatch_event_digest"].match?(/\A[0-9a-f]{64}\z/)
+            raise AttemptErrors::ReceiptRejected, "publication OTP need differs from original dispatch"
+          end
+          value
+        rescue JSON::ParserError, KeyError, TypeError
+          raise AttemptErrors::ReceiptRejected, "publication OTP need is invalid"
+        end
+
+        def publication_challenge!(record, pending: nil)
+          context(record)
+          commit = pending && pending[:commit] || @journal.ref_value
+          events = pending && pending[:pending_events] ? pending.fetch(:current_events) + pending.fetch(:pending_events) :
+            @journal.read_events(record.fetch("assignment_id"), commit: commit).select { |event| event["attempt_id"] == record.fetch("attempt_id") }
+          unless Models::EvidenceEvent.chain_valid?(events)
+            raise AttemptErrors::EvidenceUnavailable, "publication challenge chain is corrupt"
+          end
+          event = events.find { |row| row["digest"] == record["publication_challenge_event_digest"] }
+          unless event && event["type"] == "service_publication_challenge" &&
+              event.dig("payload", "challenge_digest") == record["publication_challenge_digest"] &&
+              event.dig("payload", "request_id") == record["request_id"] &&
+              event.dig("payload", "generation") == record["publication_challenge_generation"]
+            raise AttemptErrors::EvidenceUnavailable, "publication challenge introduction is unavailable"
+          end
+          reference = record.fetch("publication_challenge_ref")
+          bytes = if pending && pending[:pending_events]
+            @canonical.read_pending(reference, **context(record), current_events: pending.fetch(:current_events),
+              pending_events: pending.fetch(:pending_events), blobs: pending.fetch(:blobs), commit: commit)
+          else
+            @canonical.read(reference, **context(record), commit: commit)
+          end
+          unless Digest::SHA256.hexdigest(bytes) == record.fetch("publication_challenge_digest")
+            raise AttemptErrors::EvidenceUnavailable, "publication challenge digest differs"
+          end
+          need = publication_need!(bytes, record, previous: event.dig("payload", "previous_challenge_digest"))
+          dispatch = events.find { |row| row["digest"] == need.fetch("dispatch_event_digest") }
+          unless dispatch && dispatch["type"] == "authority_mutation" && dispatch.dig("payload", "operation") == "begin_dispatch" &&
+              dispatch.dig("payload", "data", "request_id") == record.fetch("request_id") &&
+              dispatch.dig("payload", "data", "executor_process_binding") == record.fetch("executor_process_binding")
+            raise AttemptErrors::EvidenceUnavailable, "publication need has no original executor dispatch"
+          end
+          need
+        rescue KeyError, TypeError
+          raise AttemptErrors::EvidenceUnavailable, "publication challenge evidence is incomplete"
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/task_context_entry.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      # Structural admission of source-owned pins. Artifact authentication belongs
+      # to the selected entry owner; these references are never an execution grant.
+      module TaskContextEntry
+        LIMITS = {"manifest" => 65_536, "wrapper" => 33_554_432}.freeze
+
+        def self.validate!(value)
+          unless value.is_a?(Hash) && value.keys.sort == LIMITS.keys.sort
+            raise ArgumentError, "task context entry fields differ"
+          end
+          LIMITS.each do |key, limit|
+            reference = value[key]
+            unless reference.is_a?(Hash) && reference.keys.sort == %w[bytes path sha256] &&
+                reference["bytes"].is_a?(Integer) && reference["bytes"].between?(1, limit) &&
+                reference["sha256"].is_a?(String) && reference["sha256"].match?(/\A[0-9a-f]{64}\z/) &&
+                reference["path"].is_a?(String) && reference["path"].encoding == Encoding::UTF_8 &&
+                reference["path"].valid_encoding? && reference["path"].bytesize.between?(2, 4096) &&
+                !reference["path"].include?("\0") && reference["path"].start_with?("/") &&
+                File.expand_path(reference["path"]) == reference["path"]
+              raise ArgumentError, "task context entry reference differs"
+            end
+          end
+          value
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/transfer_codec.rb

@@ -3,6 +3,7 @@
 require "digest"
 require "tempfile"
 require "timeout"
+require "ace/runtime/molecules/protected_socket"
 require_relative "private_directory"
 
 module Ace
@@ -12,11 +13,10 @@ module Ace
       # Server selects purpose from a source handler's fixed operation table,
       # admits a transfer slot before calling, and holds no journal lock here.
       class TransferCodec
-        LIMITS = {candidate: [64 * 1024 * 1024, 1, 64 * 1024 * 1024],
+        LIMITS = {prompt_text: [16_384, 1, 16_384], scope_boundary_observation: [65_536, 1, 65_536], candidate: [64 * 1024 * 1024, 1, 64 * 1024 * 1024],
                   artifacts: [256 * 1024, 16, 64 * 1024],
                   receipt_artifacts: [272 * 1024, 17, 64 * 1024],
-                  service_input: [64 * 1024, 1, 64 * 1024],
-                  inbox_proof: [32 * 1024, 2, 16 * 1024]}.freeze
+                  service_input: [64 * 1024, 1, 64 * 1024]}.freeze
         SHA256 = /\A[0-9a-f]{64}\z/
 
         class Input
@@ -43,16 +43,51 @@ module Ace
           end
         end
 
-        def initialize(root:)
-          @root = PrivateDirectory.verify!(root)
+        def initialize(root: nil)
+          @root = root && PrivateDirectory.verify!(root)
         end
 
         # Upload write-EOF is required before invoking the mutation consumer.
-        # Persistent launch gate connections never use this codec.
+        # Persistent launch prompt streams use their fixed framed entry point below.
         def receive(socket, descriptor:, purpose:, deadline:)
+          receive_parts(socket, descriptor: descriptor, purpose: purpose, deadline: deadline, eof: true) { |input| yield input }
+        end
+
+        # Fixed authenticated launch_control stream only. A declared exact
+        # prompt body is followed by the next bounded control frame; unlike
+        # public uploads, this private duplex connection remains writable.
+        def receive_launch_prompt(socket, descriptor:, transfer_id:, deadline:)
+          deadline = [deadline, Process.clock_gettime(Process::CLOCK_MONOTONIC) + 30].min
+          marker = launch_prompt_marker(transfer_id)
+          receive_parts(socket, descriptor: descriptor, purpose: :prompt_text, deadline: deadline, eof: false) do |input|
+            boundary = Ace::Runtime::Molecules::ProtectedSocket.read(socket, deadline: deadline, limit: 16_384, with_size: true)
+            unless boundary.fetch(:data) == marker && boundary.fetch(:bytesize) == (JSON.generate(marker) + "\n").bytesize
+              reject!("Private prompt boundary differs")
+            end
+            yield input
+          end
+        end
+
+        def send_launch_prompt(socket, bytes:, descriptor:, transfer_id:, deadline:)
+          deadline = [deadline, Process.clock_gettime(Process::CLOCK_MONOTONIC) + 30].min
+          marker = launch_prompt_marker(transfer_id)
+          send(socket, parts: [bytes], descriptor: descriptor, purpose: :prompt_text, deadline: deadline)
+          Ace::Runtime::Molecules::ProtectedSocket.write(socket, marker, deadline: deadline, limit: 16_384)
+        end
+
+        def launch_prompt_marker(transfer_id)
+          unless transfer_id.is_a?(String) && transfer_id.match?(/\A[0-9a-f]{32}\z/)
+            raise ArgumentError, "invalid private prompt transfer identity"
+          end
+          {"type" => "launch_prompt_end", "transfer_id" => transfer_id}
+        end
+        private :launch_prompt_marker
+
+        def receive_parts(socket, descriptor:, purpose:, deadline:, eof:)
           validate!(descriptor, purpose)
           descriptor = descriptor.merge("parts" => descriptor.fetch("parts").map { |part| part.dup.freeze }.freeze).freeze
           deadline = [deadline, Process.clock_gettime(Process::CLOCK_MONOTONIC) + 30].min
+          raise ArgumentError, "receive requires protected source scratch" unless @root
           PrivateDirectory.verify!(@root)
           Tempfile.create(["transfer-", ".bytes"], @root, binmode: true) do |file|
             digest = Digest::SHA256.new
@@ -70,12 +105,13 @@ module Ace
               reject!("Transferred part digest differs") unless part_digest.hexdigest == part["sha256"]
             end
             reject!("Transferred aggregate digest differs") unless digest.hexdigest == descriptor["sha256"]
-            reject!("Transferred bytes exceed declared size") unless read(socket, 1, deadline).nil?
+            reject!("Transferred bytes exceed declared size") if eof && !read(socket, 1, deadline).nil?
             file.flush
             file.rewind
             yield Input.new(file, descriptor)
           end
         end
+        private :receive_parts
 
         def descriptor(parts, purpose:)
           reject!("Invalid transfer parts") unless parts.is_a?(Array) && parts.all? { |part| part.is_a?(String) }
@@ -113,13 +149,9 @@ module Ace
                 part["bytes"].is_a?(Integer) && part["bytes"].between?(0, each) &&
                 part["sha256"].is_a?(String) && part["sha256"].match?(SHA256) } &&
               descriptor["bytes"] == descriptor["parts"].sum { |part| part["bytes"] } &&
-              (!%i[candidate service_input].include?(purpose) || descriptor["bytes"].positive?)
+              (!%i[candidate service_input prompt_text].include?(purpose) || descriptor["bytes"].positive?)
             reject!("Invalid or oversized transfer descriptor")
           end
-          if purpose == :inbox_proof &&
-              (descriptor.fetch("parts").length != 2 || descriptor.fetch("parts").any? { |part| part.fetch("bytes").zero? })
-            reject!("Inbox proof requires exactly two nonempty bounded parts")
-          end
           if purpose == :receipt_artifacts
             receipt, *evidence = descriptor.fetch("parts")
             unless receipt.fetch("bytes").between?(1, 16 * 1024) && evidence.sum { |part| part.fetch("bytes") } <= 256 * 1024

data/lib/ace/assign/cli/commands/assignment_target.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+require_relative "../../authority/protected_assignment_context"
 
 module Ace
   module Assign
@@ -11,11 +12,16 @@ module Ace
         # - <assignment-id>@<step-number>
         module AssignmentTarget
           DEFAULT_TARGET_ENV = "ACE_ASSIGN_DEFAULT_TARGET"
-          Target = Struct.new(:assignment_id, :scope, keyword_init: true)
+          Target = Struct.new(:assignment_id, :scope, :prepared_input, keyword_init: true)
           View = Struct.new(:assignment, :state, :scoped_state, :active_steps, :next_step, :focus_step, :scope_root, keyword_init: true)
 
           private
 
+          def refuse_protected_graph_mutation!(options)
+            context = @protected_assignment_context ||= Ace::Assign::Authority::ProtectedAssignmentContext.load
+            context.refuse_graph_mutation!(options: options)
+          end
+
           def resolve_assignment_target(options)
             assignment_raw = options[:assignment]
             explicit_target = unless assignment_raw.nil? || assignment_raw.to_s.strip.empty?
@@ -29,7 +35,13 @@ module Ace
                 "does not match #{DEFAULT_TARGET_ENV}=#{target_identity(env_target)}"
             end
 
-            explicit_target || env_target || Target.new(assignment_id: nil, scope: nil)
+            target = explicit_target || env_target || Target.new(assignment_id: nil, scope: nil)
+            context = @protected_assignment_context ||= Ace::Assign::Authority::ProtectedAssignmentContext.load
+            target.prepared_input = context.resolve(options: options, assignment_id: target.assignment_id, scope: target.scope)
+            if target.prepared_input && ![Status, Step, Start, Finish, Fail, Resume].any? { |command| is_a?(command) }
+              raise AttemptErrors::EvidenceUnavailable, "protected queue command requires a reviewed new prepared version and attempt"
+            end
+            target
           end
 
           def parse_assignment_target(raw)
@@ -63,6 +75,7 @@ module Ace
           end
 
           def build_executor_for_target(target)
+            return Ace::Assign::Authority::PreparedExecutor.new(target.prepared_input) if target.prepared_input
             return Organisms::AssignmentExecutor.new unless target.assignment_id
 
             manager = Molecules::AssignmentManager.new